Medium severity6.5NVD Advisory· Published Sep 9, 2019· Updated Jun 17, 2026

CVE-2019-15297

Description

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Digium/Asterisk
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Range: >=15.0.0,<=15.7.3
Sangoma/Asteriskdescription
Freepbx/Asteriskllm-create
Range: <15.7.4, <16.5.1

Patches

Vulnerability mechanics

References

downloads.asterisk.org/pub/security/AST-2019-004.htmlnvdPatchVendor Advisory
packetstormsecurity.com/files/154371/Asterisk-Project-Security-Advisory-AST-2019-004.htmlnvdPatchThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/161671/Asterisk-Project-Security-Advisory-AST-2021-006.htmlnvd
seclists.org/fulldisclosure/2021/Mar/5nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000